Privacy policy

Scope and contact

Narayana, Inc. operates ctrl payments and its ChatGPT integration. This policy covers the read-only ChatGPT integration, its account and workspace authentication, the hosted monitoring dashboard and website subscription billing, website visits, and related support requests. Other ctrl payments products and customer deployments may have separate agreements and policies. Contact support@ctrlpayments.com for privacy questions and requests. Evidence retained in a customer-operated deployment is also subject to that operator’s arrangements.

Information used by the integration

We process your account email, user identifier, authentication sessions, workspace membership and OAuth authorization to sign you in and restrict access. After you consent, the integration can read your joined workspaces and their synchronized payment evidence: agent and workspace identifiers, payment action and rail, test/live environment, amounts and currencies, recorded counterparty and resource references, decisions, outcomes, reasons, receipt identifiers and hashes, effect states, rule-based signals and supporting receipt IDs, and connector modes, versions and synchronization timestamps.

References, reasons and signal text supplied by your deployment can contain personal or confidential business information. Supply only data you are authorized to share. The integration does not return member email lists, raw receipt documents, payment-provider error payloads, credential paths, connection tokens, full card numbers or payment credentials. It cannot initiate payments, issue refunds, answer approvals or change policy.

Purpose and sharing

We use this information to authenticate users, enforce workspace access, return requested evidence, operate and secure the service, and respond to support requests. The integration reads the existing evidence store; it does not create a separate copy of that store.

Vercel hosts the service and website; Supabase provides the database and authentication. Requested tool results are sent to OpenAI and may appear in your ChatGPT conversation. If you approve the email permission, OpenAI also receives your account email. If you approve refresh access, the read-only connection can remain active using refresh tokens until authorization expires or you revoke it. OpenAI’s own privacy settings and policies apply to its handling of those results and conversations. Disconnecting the integration does not remove previously returned results from ChatGPT.

Support email is forwarded through ImprovMX to a Gmail inbox operated by our support contact. Website enquiry forms use Resend for email delivery. Account confirmation, invitation and recovery emails use Supabase’s configured email delivery service; Resend is the configured custom SMTP provider. Dashboard signup and sign-in use Supabase. Legacy website authentication endpoints use WorkOS, separately from the dashboard and ChatGPT connection. These providers may process data outside your country. Do not send passwords, payment credentials or full card numbers in support messages.

Website analytics and sessions

The website build includes Vercel Web Analytics and PostHog. These services process website usage and event information; PostHog can use browser identifiers and cookies. The current website links signup and sign-in to the dashboard; the marketing analytics code does not receive the dashboard’s authentication session. Legacy website sign-in pages, if used, can associate their authenticated visitor’s identifier and account information with analytics. Dashboard authentication uses session cookies. A workspace-scoped cookie remembers a choice to continue with the free preview for up to one year; it does not change paid entitlements. This website analytics code is separate from the read-only MCP evidence endpoint.

Website subscription billing

When a workspace owner chooses a website subscription, the server sends their account email, workspace name and workspace identifier to Stripe to create the subscription checkout. Stripe hosts payment entry and the billing portal. Our billing tables store Stripe customer, subscription, checkout session and processed-event identifiers, the selected price, test/live mode, subscription status, paid-period end and cancellation status. We use signed Stripe notifications to update the workspace subscription. The ChatGPT integration cannot read these billing tables or open checkout.

Raw card details are entered on Stripe’s hosted pages and are not stored in our billing tables. Stripe processes payment information under its own policies. Billing information may be retained for accounting, disputes and applicable legal obligations; workspace deletion does not promise deletion of records held by Stripe. Contact support@ctrlpayments.com about the scope of a billing-data request.

Retention and deletion

Hosted payment evidence is retained until the workspace is deleted; the ChatGPT integration does not apply an automatic time-based purge. Account information is retained while the account exists. Removing an individual account does not automatically delete a shared workspace owned by another person.

Account owners can request account deletion, and authorized workspace owners can request workspace and hosted-evidence deletion, by emailing support@ctrlpayments.com. Requests are handled manually after identity and authority checks. We will acknowledge a request and explain its scope, any information needed and any applicable legal or contractual retention requirement. Customer-operated source stores and copies already sent to OpenAI are outside this hosted deletion process.

Support messages are retained in the support inbox until manually removed or a verified deletion request is fulfilled; no automatic support-email purge is currently configured. Authentication sessions and OAuth authorizations remain until they expire or are revoked. Authentication and operational logs, website analytics, and provider-managed backups are separate from workspace evidence; they expire under provider retention settings and may remain after active records are deleted. Their periods depend on the provider and service plan. Contact support@ctrlpayments.com for the settings relevant to your request or to request removal of identifiable analytics and support records; we do not promise immediate deletion from provider-managed backups.

Your choices

You can disconnect ctrl payments in ChatGPT to stop its use through that connection. For server-side revocation or questions about access, email support@ctrlpayments.com. Workspace membership checks restrict every evidence request. Disconnecting does not itself delete your account or workspace evidence.

Contact us to request access, correction or deletion of your personal data, or to raise a privacy concern. We verify identity and workspace authority before disclosing or changing data. Applicable law may provide additional rights.

Changes

We will update the effective date when this policy changes and communicate material changes through the service or available account contact information.